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IN THE UNITED STATES DISTRICT COURT 
FOR THE DISTRICT OF THE DISTRICT OF COLUMBIA 



DANIEL KENNEDY, 

1717 H Street 
Areata, CA 95521, 
on behalf of himself 
and all others similarly 
situated 



Plaintiff, 



vs. 



UNITED STATES DEPARTMENT 
OF VETERANS AFFAIRS, 

810 Vermont Avenue NW 
Washington, DC 20420, 

R. JAMES NICHOLSON, Secretary 
of the United States Department of 
Veterans Affairs, officially and 
individually, 

810 Vermont Avenue NW 
Washington, DC 20420, 

GORDON G. MANSFIELD, Deputy 
Secretary of the United States 
Department of Veterans Affairs, 
officially and individually, 
810 Vermont Avenue NW 
Washington, DC 20420, 



CASE NO. 1:06CV01070 



AMENDED 

CLASS ACTION COMPLAINT 



Defendants. 



I. PRELIMINARY STATEMENT 

1. Plaintiff Daniel Kennedy brings this action pursuant to the Privacy Act of 1974 



and the Fourth and Fifth Amendments to the United States Constitution on behalf of himself 
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and all others similarly situated against the United States Department of Veterans Affairs 
("VA"), Secretary R. James Nicholson, and Deputy Secretary Gordon H. Mansfield. 

2. Plaintiff, a veteran of the United States Army, is one of more than 26.5 million 
military veterans whose private personal information, including Social Security number, was 
improperly, unlawfully, willfully and intentionally disclosed in at least three ways: (1) 
through the access and removal of data files containing the private personal information of 
26.5 million veterans from the VA facility by an employee of the VA ; (2) through the 
transfer of the data to external and unprotected disks and/or computers by that VA employee; 
and (3) through the alleged theft of these disks and/or computers by a third party, the identity 
of whom may never be known. These disclosures, made without Plaintiffs knowledge or 
consent, violate 5 U.S.C. § 552a(b). 

3. These disclosures were the direct and proximate result of Defendants' willful and 
intentional failure to establish and enforce appropriate safeguards to ensure the security and 
privacy of veteran records and to protect against any known or anticipated threats or hazards 
to the security and integrity of these records in violation of 5 U.S.C. § 552a(e)(10). 

4. Subsequent to learning of these disclosures. Defendants were deliberately 
indifferent in failing to take reasonable corrective action, including but not limited to, 
providing prompt and accurate notification of the disclosures to law enforcement and the 
affected veterans despite knowledge of the substantial risk of serious harm to the personal 
and financial security of the affected veterans as result of the disclosures. 

5. Defendants' disclosures of Plaintiff ' s confidential Social Security number also 
violated Plaintiff's right to privacy and personal security of his Social Security number under 
the Fourth and Fifth Amendments of the United States Constitution. 
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6. As result of the Defendants' acts and omissions in disclosing and failing to protect 
Plaintiff's private personal information, including his Social Security number, Plaintiff and 
those similarly situated have been placed at a substantial risk of harm in the form of identity 
theft and have incurred and will incur actual damages in an attempt to prevent identity theft 
by purchasing services to monitor their credit information. The remedies sought include 
declaratory and remedial injunctive relief, damages and reasonable attorneys' fees and costs. 

IL JURISDICTION AND VENUE 

7. The jurisdiction of this Court is invoked pursuant to 28 U.S.C. § 1331. Federal 
jurisdiction is appropriate in this instance to secure protection and to redress deprivations of 
rights guaranteed under 5 U.S.C. § 552a. 



8. Venue is appropriate pursuant to 5 U.S.C. § 552a(g)(5) and 28 U.S.C. 



1391(e). 



III. PARTIES 



9. Plaintiff Daniel Kennedy is a veteran of the United States Army honorably 
discharged from service in 2002. He is a resident of Areata, California. 

10. Defendant VA is a cabinet of the executive branch of the United States 
Government which, in the course of its duties, compiles and maintains records of all 
individuals discharged from a branch of the United States military and provides benefits and 
services to veterans, including among other things, pension payments and health care. 

11. Defendant R. James Nicholson is the duly-confirmed Secretary of United States 
Department of Veterans Affairs and is responsible for the enactment and enforcement of all 
VA policies and procedures, including those pertaining to safeguards to ensure the security 
and privacy of veteran records and to protect against any anticipated threats or hazards to the 
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security and integrity of these records, He is sued in his official and individual capacities. 

12. Defendant Gordon H. Mansfield is the duly-appointed Deputy Secretary of the 
United States Department of Veterans Affairs and is responsible for the enactment and 
enforcement of all VA policies and procedures, including those pertaining to safeguards to 
ensure the security and privacy of veteran records and to protect against any anticipated 
threats or hazards to the security and integrity of these records. He is sued in his official and 



individual capacities. 



IV. STATEMENT OF FACTS 



13. In connection with his honorable discharge after service with the United States 
Army, Plaintiff was required to provide the VA with his private personal information, 
including Social Security number. 

14. On or about May 22, 2006, Secretary Nicholson publicly announced through 
worldwide media outlets that the private personal information of 26.5 million veterans 
discharged after 1975 had been disclosed. The private personal information of these veterans 
disclosed included names, dates of birth. Social Security numbers, disability ratings, and 
upon information and belief, certain medical information. 

15. Secretary Nicholson reported the disclosure was connected to an alleged burglary 
of the home of a VA employee. Upon information and belief, on or about May 3, 2006, that 
VA employee, a low-ranking data analyst and long-time VA employee, had removed from 
the VA facility VA files containing private personal information of 26.5 million persons 
comprised of veterans discharged since 1975 and as many as 1.1 million active-duty military 
personnel, 430,000 National Guard members and 645,000 reserve members and had taken 
the files to his home. The VA employee who removed the files to his home then copied the 
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files onto his computer and/or external disks for an unspecified purpose. The VA 
employee's computer and/or disks were allegedly stolen during a burglary of his home. Upon 
information and belief, these items have not been recovered as of the date of the filing of this 
Complaint. They are not believed to be encrypted or password protected and can be easily 
accessed and duplicated. 

16. Upon information and belief, the VA employee who removed the files from the 
VA facility was able to easily access computer files containing private personal information 
of 26.5 million veterans and copy the files from the VA's system onto external disks and his 
personal computer. Upon further information and belief, this VA employee had been 
removing the data from the VA facility for a period of three years in a practice expressly or 
implicitly ratified by the VA. The VA employee's access to and duplication of this 
information was a disclosure in violation of 5 U.S.C. § 552a(b) and the result of Defendants' 
willful and intentional failure to establish appropriate safeguards to ensure the security and 
confidentiality of veteran records and to protect against any anticipated threats or hazards to 
the security and integrity of these records in violation of 5 U.S.C. § 552a(e)(10). 

17. Upon information and belief, VA officials knew about the theft within hours of 
the crime but did not inform Secretary Nicholson until 13 days later. Upon learning of the 
above-described disclosures. Secretary Nicholson and Deputy Secretary Mansfield 
unreasonably delayed reporting the disclosures to law enforcement agencies despite 
knowledge of the imminent and substantial risk of serious harm to the personal security of 
the affected veterans. VA Inspector General George Opfer publicly stated that he was never 
formally notified of the disclosures, but rather heard about it through "gossip." 

18. Three weeks after the alleged burglary. Secretary Nicholson advised media 
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outlets that the 26.5 million veterans whose private personal information was disclosed were 
subject to a heightened risk for identity theft. He urged the veterans to be "extra vigilant and 
to carefully monitor bank statements, credit card statements and any statements relating to 
recent financial transactions." Upon information and belief, Defendants have not provided 
credit protection and credit monitoring for Plaintiff and Class Members. In the meantime, 
the VA employee who removed the data from the VA facility has been fired. His boss 
resigned last week and another senior VA official is on administrative leave pending 
investigations by the FBI, the VA inspector general and Montgomery County police. 

19. Defendants knew or should have known that their computer security practices 
were not in compliance with 5 U.S.C. § 522a as well as other federal laws relating to 
information security. In 2003, a study conducted by the General Accounting Office (GAO) 
gave the VA a failing grade for its computer security practices. In March 2006, the United 
States House of Representative's Committee on Government Reform gave the VA an "F" in 
its annual report card relating to information security. Despite this ample and specific notice 
of noncompliance and the potential adverse effect of random and unauthorized disclosures of 
personal information. Defendants failed to establish appropriate safeguards to ensure the 
security and confidentiality of veteran records and to protect against any anticipated threats 
or hazards to the security and integrity of these records in violation of 5 U.S.C. § 
552a(e)(10). 

20. The unauthorized and unconsented disclosure of an individual's name, address, 
date of birth and Social Security number creates a substantial risk of identity theft. An 
individual's Social Security number is the most useful identifier for retrieving information 
from public record databases, financial institutions and credit bureaus. Armed with an 
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individual's name, address, date of birth and Social Security number, an identity thief is able 
to quickly and easily steal an identity, whereas, without such information, the task is difficult, 
time consuming and costly. 

21. Recent nationwide studies confirm that, on average, victims of identity theft 
spend hundreds of hours in personal time and hundreds of dollars in personal funds to resolve 
their credit issues. See www.idtheftcenter.org; www.fte.org . 

22. Defendants' unauthorized and unconsented disclosures of Plaintiff ' s and Class 
Members' private personal information and the imminent and substantial risk of identity theft 
to which Plaintiff and Class Members have been exposed is the direct result of Defendants' 
failure to: (1) establish appropriate administrative, technical and physical safeguards to 
ensure the security and confidentiality of records; (2) to protect against any anticipated 
threats or hazards to the security and integrity of these records; and (3) to promptly take 
reasonable measures to correct the disclosures, including but not limited to, providing law 
enforcement and the affected veterans with prompt and accurate notice of the disclosures. 

23. The Defendants' loss of Plaintiff ' s and Class Members' private personal 
information is unprecedented in scope and raises concerns about the safety of U.S. military 
forces. For example, the Plaintiff's and Class Members' private personal information could 
be used to find out where military personnel live. As a direct and proximate result of 
Defendants' acts and omissions. Plaintiff and Class Members have been exposed to a risk of 
substantial harm and inconvenience, and have incurred or will incur actual damages in 
purchasing comprehensive credit reports and/or monitoring of their identity and credit. 

V. CLASS ALLEGATIONS 

24. Plaintiff maintains this action on behalf of himself and all individuals whose 
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private personal information, including Social Security numbers, were disclosed by 
Defendants in May 2006 as described above. 

25. The members of the putative class are so numerous that joinder of individual 
claims is impracticable. Moreover, there are significant questions of fact and issues of law 
common to the members of the putative class. These issues include whether Defendants 
failed to establish appropriate administrative, technical and physical safeguards to ensure the 
security and confidentiality of records and to protect against known and anticipated threats or 
hazards to the security and integrity of these records, whether such failure was willful and 
intentional, whether the putative class members were adversely affected, and whether they 
incurred actual damages as result. 

26. Plaintiffs claims are typical of the claims of the putative class. Plaintiff and all 
members of the putative class have been adversely affected and damaged in that his private 
information has been compromised and stolen. 

27. The proposed class representative will fairly and adequately represent the 
putative class because he has the class members' interest in mind, his individual claims are 
co-extensive with and identical to those of the class, and because he is represented by 
qualified counsel experienced in class action litigation of this nature. 

28. A class action in this instance is superior to other available methods for the fair 
and efficient adjudication of these claims since individual joinder of the claims of all 
members of the putative class is impracticable. Most members of the class are without the 
financial resources necessary to pursue this matter. Even if some members of the class could 
afford to litigate their claims separately, such a result would be unduly burdensome to the 
courts in which the individualized cases would proceed. Individual litigation increases the 
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time and expense of resolving a common dispute concerning Defendants' actions toward an 
entire group of individuals. Class action procedures allow for far fewer management 
difficulties in matters of this type and provide the unique benefits of unitary adjudication, 
economy of scale and comprehensive supervision over the entire controversy by a single 
court. 

29. The putative class may be certified pursuant to Rule 23(b)(1) of the Federal Rules 
of Civil Procedure because inconsistent or varying adjudications with respect to individual 
class members would establish incompatible standards of conduct for Defendants to follow. 

30. The putative class may be certified pursuant to Rule 23(b)(2) of the Federal Rules 
of Civil Procedure because Defendants have acted on grounds generally applicable to the 
putative class thereby making final injunctive relief and corresponding declaratory relief 
appropriate with respect to the claims raised by the class. 

31. The putative class may be certified pursuant to Rule 23(b)(3) of the Federal Rules 
of Civil Procedure because questions of law and fact common to class members will 
predominate over questions affecting individual members and a class action is superior to 
other methods for fairly and efficiently adjudicating the controversy and causes of actions 



described in the Complaint. 



VL STATEMENT OF CLAIMS 
COUNT ONE 



32. Plaintiff repeats and reaffirms the assertions of fact contained in paragraphs 1 
through 31 herein above. 

33. The foregoing acts and omissions of Defendant VA constitute an unauthorized, 
nonconsensual, and inappropriate disclosure of Plaintiff s Social Security number in 
violation of 5 U.S.C. § 552a(b). 
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COUNT TWO 

34. Plaintiff repeats and reaffirms the assertions of fact contained in paragraphs 1 
through 33 herein above. 

35. The foregoing acts and omissions of Defendant VA constitute a willful and 
intentional failure to establish appropriate safeguards to ensure the security and privacy of 
veteran records and to protect against known and anticipated threats or hazards to the security 
and integrity of Plaintiffs private personal records in violation of 5 U.S.C. § 552a(e)(10). 

COUNT THREE 

36. Plaintiff repeats and reaffirms the assertions of fact contained in paragraphs 1 
through 35 herein above. 

37. The foregoing acts and omissions of Defendants constitute a violation of 
Plaintiffs right to privacy in his Social Security number under the Fourth and Fifth 
Amendments to the United States Constitution. 

COUNT FOUR 

38. Plaintiff repeats and reaffirms the assertions of fact contained in paragraphs 1 
through 37 herein above. 

39. The foregoing acts and omissions of Defendants constitute a violation of 
Plaintiff s right to personal security under the Fourth and Fifth Amendments to the United 



States Constitution. 



COUNT FIVE 



40. Plaintiff repeats and reaffirms the assertions of fact contained in paragraphs 1 
through 39 herein above. 

41. The foregoing acts and omissions of Defendants deprived Plaintiff of his right to 
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procedural and substantive due process under the Fifth Amendment to the United States 



Constitution. 



COUNT SIX 



42. Plaintiff repeat and reaffirms the assertions of fact contained in paragraphs 1 
through 41 herein above. 

43. The foregoing acts and omissions of Defendants were done in deliberate 
indifference to rights guaranteed to Plaintiff under the Fourth and Fifth Amendments to the 



United States Constitution. 



VIL PRAYER FOR RELIEF 



WHEREFORE, Plaintiff, on behalf of himself and all others similarly situated, 
hereby demand judgment against Defendants as follows: 

a. For a declaration that Defendants' acts and omissions constitute a willful and 
intentional failure to establish appropriate safeguards to ensure the security and privacy of 
veteran records and to protect against known and anticipated threats or hazards to the security 
and integrity of these records in violation of 5 U.S.C. § 552a(e)(10) and the Fourth and Fifth 
Amendments of the United States Constitution. 

b. For preliminary and permanent injunctive relief enjoining, prohibiting and 
preventing Defendants from continuing to operate without appropriate safeguards to ensure 
the security and privacy of veteran records and to protect against anticipated threats or 
hazards to the security and integrity of these records, and an identity and/or credit monitoring 
program for the benefit of Plaintiff and the proposed class under the Court's supervision to 
safeguard against the serious harm attendant to the improper disclosure/theft of confidential 
information; 
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c. For an award of damages for Plaintiff and each affected class member in an 
amount no less than $ 1,000.00 as well as an identity and/or credit monitoring program for 
the benefit of Plaintiff and the proposed class under the Court's supervision to safeguard 
against the serious harm attendant to the improper disclosure/theft of confidential 
information; 

d. For an award of reasonable attorney fees and costs incurred by Plaintiff and the 
members of the putative class in prosecuting this matter; and 

e. For an award of such other relief in law and equity to which Plaintiff and the 
members of the putative class may be entitled under the premises. 



DATED: June 13, 2006 By: /s/. 



Gary E. Mason 

The Mason Law Firm, P.C. 

1225 19'^ Street, NW 

Suite 500 

Washington, D.C. 20038 

Telephone: (202) 429-2290 

Facsimile: (202) 429-2294 

Alexander E. Bamett 
The Mason Law Firm, P.C. 
One Pennsylvania Plaza 
Suite 4632 

New York, NY 10119 
Telephone: (212) 362-5770 
Facsimile: (917) 591-5227 

Peter N. Wasylyk 

The Law Offices of Peter N. Wasylyk 

1307 Chalkstone Avenue 

Providence, RI 02908 

Telephone: (401) 831-7730 

Facsimile: (401) 861-6064 
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Andrew S. Kierstead 

The Law Office of Andrew S. Kierstead 

1001 S.W. Fifth Avenue 

Portland, OR 97204 

Telephone: (508) 224-6246 

Facsimile: (508) 224-4356 

Counsel for Plaintijf 
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